7 Ways to Avoid Fake Meeting Scams and "Audio Fix" Malware

The U.S. Justice Department and the FBI have detailed North Korea's "FaceStealer" campaign, which relied on fake video meetings, recorded clips of earlier victims and a staged "audio problem" that could only be fixed by downloading a malicious file. Here are practical tips from our editorial team, based on the method officials described:

1. Never download a "fix" during a meeting. If you are told your audio isn't coming through, leave the call and rejoin from the official app. Zoom and Teams do not ask you to download a tool from a chat link.
2. Verify the invitation through a second channel. If a colleague invites you on Telegram or LinkedIn, confirm with a phone call or a message on another channel you already use.
3. Check the domain carefully. Fake meeting links use look-alike domains. Type the platform's address yourself instead of clicking the link.
4. A familiar face is not proof. The attackers played recorded clips of earlier victims and deepfakes of well-known figures. Ask the speaker to do something spontaneous, or verify them outside the meeting.
5. Keep devices separate. Don't use the machine that holds your crypto wallet or has access to code repositories for meetings with new contacts.
6. Turn on security keys (passkeys / FIDO2) for GitHub, email and exchange accounts; they resist password theft.
7. If in doubt, act fast. Disconnect the device from the network, change your passwords from another device and warn your contacts that your account may be compromised, because the attackers use victims' accounts to target their friends.

A staged "technical glitch" followed by a link to fix it is the heart of the trick as the FBI describes it. Remember that in your next meeting.